CVE-2026-119829

Heap-based buffer overflow in Windows USB Audio Class driver usbaudio.sys allows an unauthorized attacker to elevate privileges with a physical attack...

CVE-2026-119829

CVE-2026-119829 involves a heap-based buffer overflow in the Windows USB Audio Class driver (usbaudio.sys) . This vulnerability allows an unauthorized attacker to achieve elevation of privilege via a physical attack . No specific exploit details or direct links are provided in the documents, but ...

EUVD-2026-122347

Heap-based buffer overflow in Windows USB Audio Class driver usbaudio.sys allows an unauthorized attacker to elevate privileges with a physical attack...

Windows USB Audio Class driver (usbaudio.sys) Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows USB Audio Class driver usbaudio.sys allows an unauthorized attacker to elevate privileges with a physical attack...

November 10, 2026 — KB5132059 (OS Build 28000.3501)

November 10, 2026 — KB5132059 OS Build 28000.3501 Applies To Windows 11 version 26H1, all editions This cumulative update for Windows 11, version 26H1 KB5132059 includes the latest security fixes and improvements, along with non-security updates from last month's optional preview release. Visit t...

PT-2026-143846

Heap-based buffer overflow in Windows USB Audio Class driver usbaudio.sys allows an unauthorized attacker to elevate privileges with a physical attack...

CVE-2026-99271

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture ALSA Line 6 USB audio driver. When releasing audio capture buffers, the driver fails to clear an internal buffer pointer, leaving a stale reference to freed memory. A local user can exploit this issue by triggering audio...

CVE-2026-90975

A vulnerability in Realtek's RtUsbA64.sys USB audio driver allows a local, low-privileged user to abuse a kernel I/O control IOCTL interface that acts on a caller-supplied user-mode pointer without proper validation or capture. By issuing crafted property requests an attacker can obtain kernel-mo...

CVE-2026-122113

A vulnerability in Realtek's RtUsbA64.sys USB audio driver allows a physically present attacker using a maliciously crafted USB device to trigger unbounded recursion in the driver's topology-parsing logic during device enumeration. Processing the crafted descriptor exhausts the kernel stack and...

EUVD-2026-118417

A vulnerability in Realtek's RtUsbA64.sys USB audio driver allows a physically present attacker using a maliciously crafted USB device to trigger unbounded recursion in the driver's topology-parsing logic during device enumeration. Processing the crafted descriptor exhausts the kernel stack and...

CVE-2026-122113 CVE-2026-122113

A vulnerability in Realtek's RtUsbA64.sys USB audio driver allows a physically present attacker using a maliciously crafted USB device to trigger unbounded recursion in the driver's topology-parsing logic during device enumeration. Processing the crafted descriptor exhausts the kernel stack and...

CVE-2026-122113

A vulnerability exists in Realtek's RtUsbA64.sys USB audio driver, where a physically present attacker can use a maliciously crafted USB device to trigger unbounded recursion in the driver's topology-parsing logic during device enumeration. Processing the crafted descriptor leads to kernel stack ...

EUVD-2026-118416

A vulnerability in Realtek's RtUsbA64.sys USB audio driver allows a local, low-privileged user to abuse a kernel I/O control IOCTL interface that acts on a caller-supplied user-mode pointer without proper validation or capture. By issuing crafted property requests an attacker can obtain kernel-mo...

CVE-2026-90975

A vulnerability exists in Realtek's RtUsbA64.sys USB audio driver, where a local, low-privileged user can abuse a kernel I/O control (IOCTL) interface . The root cause is the lack of proper validation or capture of a caller-supplied user-mode pointer. By issuing crafted property requests, an atta...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write on Type II inbound URBs dataepsetparams calculates the size of each URB transfer buffer before adding the Format Type II transfer delimiter: u-packets = urbpacks; u-buffersize = maxsize u-packets; i...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: qcom: rejecting a disable request when there is no active interface The handleuaudiostreamreq function resolves an interface index using infoidxfromifnum. This function returns -EINVAL if no interface matches the...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: qcom: clearing of the opened substreams occurs when stream enable fails. When stream enable is activated, subs-opened is set before the serviceinterval is validated. An invalid interval causes the process to jump...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write in sndusbmidius122loutput sndusbmidius122loutput sets a count of 2 for any operation slower than high-speed, but never references it in ep-maxtransfer. The URB buffer contains exactly maxtransfer...

Astra Linux – vulnerability in linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints MIDI 2.0 input URBs are initiated during sndusbmidiv2create. A subsequent setup failure may still trigger sndusbmidiv2free, which currently frees each endpoint and its...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Clamp frame size in implicit-feedback mode sndusbhandlesyncurb scales received sync packet sizes by the sender’s stride and stores the result directly in outpacket-packetsizei. If a connected USB device sends an...